← Back to Scanner

canvas-os Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower
Source:
SHA-256:

canvas-os is an AI agent skill, created by JarvisPC and published at openclaw/skills. ClawSecure audited canvas-os across 10 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 55/100 (Medium Risk). The 6 findings concentrate in Unauthorized Tool Use, Code Injection and Policy Violation, including Detects system manipulation, privilege escalation, and destructive file... and Detects system manipulation, privilege escalation, and destructive file.... 4 were rated high or critical severity.

Is canvas-os safe?

ClawSecure audited canvas-os and assigned a security score of 55/100 (Medium Risk), identifying 6 findings across Unauthorized Tool Use and Code Injection. Review the findings below before installing.

What did ClawSecure find in canvas-os?

ClawSecure identified 6 findings in canvas-os, concentrated in Unauthorized Tool Use, Code Injection and Policy Violation. 4 were rated high or critical severity. The most severe include Detects system manipulation, privilege escalation, and destructive file... and Detects system manipulation, privilege escalation, and destructive file....

How was canvas-os audited?

ClawSecure ran canvas-os through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 10 files from openclaw/skills.

What does a score of 55 mean?

ClawSecure assigned canvas-os a security score of 55/100, placing it in the Medium Risk range. This reflects 6 findings led by Unauthorized Tool Use that warrant review before production use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for canvas-os

ClawSecure detected 6 security findings in canvas-os, spanning Unauthorized Tool Use, Code Injection, Policy Violation and Permissions Manifest.

Each finding is expandable in the interactive list below.

3-Layer Audit Protocol

Security Recommendations for canvas-os

Eliminate dynamic code execution
canvas-os evaluates code at runtime (for example eval or dynamic exec). Remove dynamic evaluation of untrusted input, and where code generation is unavoidable, sandbox it and validate every input.
Resolve policy violations
canvas-os trips ClawSecure policy checks. Review each flagged pattern against your security policy and remediate or document an accepted exception before production use.
Add a config.json permissions manifest
A config.json file declares what an agent component can access: file system, network, shell execution and more. Without it, users have no visibility into what the component can do before installing. This is the single most impactful security improvement for any AI agent skill.

Related Security Research

Why Generic Scanners Fail at AI Agent SecurityBeyond Static Scans: Why ClawSecure Verifies Agentic Intent

Related AI Agent Security Audits

DocDesignReviewAssistantScore 65/100windows-controlScore 45/100chichi-speechScore 65/100antigravity-imageScore 65/100pdf-1wso5Score 70/100

Scanned on February 7, 2026. canvas-os is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan